Port 1840 Scans

Discussion in 'Computer Security' started by Steve-O, Mar 2, 2004.

  1. Steve-O

    Steve-O Guest

    Hi guys

    Has anyone else seen any high rate of port scans on 1840/UDP/TCP

    I get a ridiculous amount of these per day from many different networks.
    According to IANA netopia-vo2 has this port registered, (along with many
    other trojans)

    Does anyone have any info on these port scans please

    Maybe I should analyse the payload ?
     
    Steve-O, Mar 2, 2004
    #1
    1. Advertising

  2. Steve-O <> wrote:
    > Has anyone else seen any high rate of port scans on 1840/UDP/TCP
    >
    > I get a ridiculous amount of these per day from many different networks.
    > According to IANA netopia-vo2 has this port registered, (along with many
    > other trojans)
    >
    > Does anyone have any info on these port scans please
    >
    > Maybe I should analyse the payload ?


    Not on your particular pattern but it's a good idea to check:

    http://isc.sans.org/
    http://aris.securityfocus.com/ (registration required)

    And to a certain extent:

    http://securityresponse.symantec.com/

    I don't see any 1840/* issues in any of my logs.

    Cheers, -Ali

    --
    OpenPGP Key: 030E44E6
    --
    Was I helpful?: http://svcs.affero.net/rm.php?r=packetknife
    --
    How can we lose when we're so sincere?! -- Charlie Brown
     
    Ali-Reza Anghaie, Mar 2, 2004
    #2
    1. Advertising

  3. Steve-O

    David Norris Guest

    "Steve-O" <> wrote in message
    news:yd31c.4$54.3@newsfe1-win...
    > Hi guys
    >
    > Has anyone else seen any high rate of port scans on 1840/UDP/TCP
    >
    > I get a ridiculous amount of these per day from many different networks.
    > According to IANA netopia-vo2 has this port registered, (along with many
    > other trojans)
    >
    > Does anyone have any info on these port scans please
    >
    > Maybe I should analyse the payload ?
    >
    >
    >

    Port 1840 is used by an application called netopia-vo2. It's possible that
    like for example PC anywhere, servers scan the local subnet for other copies
    of themselves. That's one possibility. I don't know of any Trojans which use
    this port; that's what I would say for ports 12345 or 17300, for example.
    These are used by netbus and Kuang2 respectively. I see a lot of probes for
    these.
    DN
     
    David Norris, Mar 2, 2004
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. James Drake

    Sick of port scans

    James Drake, Apr 12, 2004, in forum: Computer Support
    Replies:
    2
    Views:
    460
    -= Hawk =-
    Apr 12, 2004
  2. Daniel Damlin

    scans on port 1910, why?

    Daniel Damlin, Jan 27, 2004, in forum: Computer Security
    Replies:
    0
    Views:
    487
    Daniel Damlin
    Jan 27, 2004
  3. Chris H.

    Port Scans from my ISP Range

    Chris H., Jan 19, 2005, in forum: Computer Security
    Replies:
    2
    Views:
    543
    donnie
    Jan 20, 2005
  4. Port scans. What are these?

    , Oct 18, 2005, in forum: Computer Security
    Replies:
    7
    Views:
    947
    ROBERT S AMP BA Drake
    Oct 23, 2005
  5. Muzzy
    Replies:
    6
    Views:
    581
    Moe Trin
    Mar 24, 2006
Loading...

Share This Page